CLF-C02 Cloud Technology and Services Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  AWS Config

  Why it's wrong here

  AWS Config is incorrect because its core function is to record and evaluate configuration changes against rules you define, such as checking whether an EBS volume is encrypted or if a security group allows unrestricted SSH. While Config can trigger remediation actions via Systems Manager Automation, it does not itself scan for missing patches, deploy updates, or maintain a patch compliance inventory. Thus, it is a governance and compliance auditing tool, not a patch management service.

  When this WOULD be correct

  A company needs to ensure that all EC2 instances are configured with specific security groups and that no unauthorized changes occur. AWS Config can continuously monitor and alert on configuration drift, enforcing compliance rules without modifying instances.

• ✓

  AWS Systems Manager

  Why this is correct

  AWS Systems Manager is the correct choice because its Patch Manager capability automates the entire patching workflow for EC2 instances, including scanning for missing security updates, deploying patches on a schedule, and generating compliance reports. This directly addresses both the need to apply patches across hundreds of instances and to track which ones are compliant. Systems Manager also integrates with IAM, CloudTrail, and SSM Agent, making it the AWS-native solution for fleet-wide patch management.

• ✗

  Amazon Inspector

  Why it's wrong here

  Amazon Inspector is incorrect because it functions as an automated vulnerability assessment service that continuously scans EC2 instances for software vulnerabilities (CVEs) and unintended network exposure. It produces a prioritized list of findings with risk scores, but it has no mechanism to apply patches or automate the remediation of those findings. Inspector is designed to help you identify what to fix, not to execute the patching process itself, which is why it cannot fulfill the fleet patching requirement.

  When this WOULD be correct

  A company needs to automatically assess EC2 instances for common vulnerabilities and exposures (CVEs) and receive a report of findings, without requiring manual scans or agent installation (using SSM Agent).

• ✗

  AWS Trusted Advisor

  Why it's wrong here

  AWS Trusted Advisor is incorrect because it provides proactive recommendations across cost optimization, performance, security, and fault tolerance by inspecting your AWS environment against best practices. For example, it might flag an underutilized EC2 instance or warn about an exposed security group, but it does not take any action to patch instances or track patch compliance. Trusted Advisor is purely an advisory tool—it highlights issues and suggests improvements, but it lacks the automation and patch management capabilities needed for this task.

  When this WOULD be correct

  A company wants to check its AWS account against AWS best practices for security, cost, or performance and receive recommendations for improvement, without needing to automate remediation. For example, identifying EC2 instances that are not using Multi-Factor Authentication or have underutilized resources.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question